Thyme

Privacy Policy

PRIVACY POLICY

This privacy policy (“Privacy Policy”) governs the manner in which THYME ______________ (“We”, “Us”, “Our”) collects, uses, maintains, discloses, and protects information collected from users (“You”, “Your”, “User(s)”) of the website https://worldofthyme.com/ and mobile application (hereinafter collectively referred to as the “Site”). This Privacy Policy is effective from ________ and applies to the Site, and all products and services offered thereunder.

This Privacy Policy was last updated on ___________.

By using this Site, You signify Your acceptance of this Privacy Policy. If You do not agree to this Privacy Policy, please do not use Our Site. Your continued use of the Site, however, shall be deemed acceptance of the terms herein.

We are a _______________________________. [HSL1] 

Your privacy is important to Us. This Privacy Policy explains how We collect, use, disclose, and safeguard Your personal information when You visit Our Site.

User Responsibilities:

While exercising Your rights under applicable data protection laws, You are responsible for complying with applicable laws, providing accurate, complete and authentic information, refraining from impersonating any other person, and ensuring that any requests, grievances, corrections, or erasure requests submitted by You are genuine and not false, frivolous, or misleading.

Information We Collect

We may collect the following categories of information from and about Users of Our Site:

Personal Information: We may collect personal information from Users in a variety of ways, including when they visit Our Site, register an account, place an order, subscribe to a newsletter, respond to a survey, complete a form, or otherwise interact with the activities, services, features, products, or resources made available on Our Site. Users may be asked for, as appropriate, personal information such as name, email address, mailing address, phone number, and payment information (such as credit/debit card details). We will collect personal information from Users only if You voluntarily submit such information to Us. Users can always refuse to supply personal information, except that it may prevent them from engaging in certain Site-related activities.

Non-Personal Information: We may collect non-personal information about Users whenever they interact with Our Site. Non-personal information may include the browser name, the type of computer or device, and technical information about Users’ means of connection to Our Site, such as the operating system, the internet service providers utilized, and other similar information.

How We Use Your Information

We collect and use Your information broadly for the following purposes:

1.            To process transactions and fulfill orders: We use the information You provide when placing an order only to provide service to that order. We do not share this information with outside parties except to the extent necessary to provide the service.

2.            To improve customer service: Information You provide helps Us respond to Your customer service requests and support needs more efficiently

3.            To personalize user experience: We may use information in the aggregate to understand how Our Users as a group use the services and resources provided on Our Site.

4.            To improve our Site: We may use feedback You provide to improve Our products and services.

5.            To send periodic emails and communications: We may use Your email address to send information and updates pertaining to Your order. It may also be used to respond to Your inquiries, questions, and/or other requests. If You decide to opt-in to Our mailing list, You will receive emails that may include company news, updates, related product or service information, etc. If at any time You would like to unsubscribe from receiving future emails, We include detailed unsubscribe instructions at the bottom of each email, or You may contact Us via Our Site.

6.            To comply with legal and regulatory obligations: We may process Your information to comply with applicable laws, court orders, or governmental requests.

7.            For security and fraud prevention: To protect Our rights, property, safety, Users, or the public and to detect, prevent, and respond to fraud, abuse, or security risks.

Cookies & Tracking Technologies

Our Site may use cookies, pixels, tags, and other similar technologies for analytics, advertising, remarketing, conversion tracking, security, performance monitoring, and website functionality purposes. This helps Us understand how Users interact with the Site, improve Our products and services, measure the effectiveness of marketing activities, and provide a more relevant User experience. A User's web browser may place cookies on their device for record-keeping purposes and to collect information regarding their interaction with the Site. Users may choose to set their web browser to refuse cookies or to alert them when cookies are being sent. If they do so, certain features or functionality of the Site may not operate properly.

Sharing And Disclosure Of Your Personal Information

We do not sell, trade, or rent Users’ personal information to others. We may share or disclose Your personal information to the following entities, only for the purposes outlined in this Privacy Policy:

Service Providers and Data Processors: We may engage third-party companies and individuals to perform services on Our behalf, including payment processing, order fulfilment, logistics and shipping, technology support, data analysis, marketing assistance, and customer service. Such third parties shall have access to personal information only to the extent necessary to perform these services and shall be required to maintain appropriate confidentiality, security, and data protection measures.

Payment Processing: Payments made through the Site are processed through authorised third-party payment service providers. We do not store debit card details, credit card details, UPI PINs, net banking credentials, or similar payment authentication information on Our systems, except where required under applicable law.

Legal Compliance: We may disclose Your information where We are legally required to do so in order to comply with applicable law, governmental requests, judicial proceedings, court orders, or legal processes.

Business Transfers: We may share or transfer Your information in connection with, or during negotiations of, any merger, sale of Our assets, financing, acquisition, restructuring, or similar corporate transaction.

Data Security

We adopt appropriate data collection, storage, and processing practices and reasonable security safeguards to protect against unauthorized access, alteration, disclosure, or destruction of Your personal information, username, password, transaction information, and data stored on Our Site. Sensitive and private data exchanges between the Site and its Users happen over a secure communication channel and is encrypted and protected with digital signatures.

In the event of a personal data breach, We shall take appropriate measures to mitigate its impact and notify the appropriate authority and affected Users in the manner prescribed under applicable law.

Data Retention

We will retain Your personal information only for as long as is necessary for the purposes for which it was collected and to the extent required to, comply with Our legal obligations, resolve disputes, and enforce Our legal agreements and policies. Upon the expiry of such period, Your personal information will be erased or anonymized in accordance with applicable law.

Your Rights

You have certain rights with respect to Your personal data. Upon receipt of a request relating to access, correction, updating, erasure, consent withdrawal, nomination or any other right available under applicable law, We may verify the identity of the requester before acting on such request and may seek additional information where reasonably necessary to confirm the requester's identity, subject to verification and applicable legal limitations. You may request:

1.           Right to Access Information: You have the right to obtain a summary of Your personal data that is being processed by Us.

2.           Right to Correction and Erasure: You have the right to request the correction of inaccurate or misleading personal data, the completion of incomplete personal data, the updating of Your personal data, and the erasure of Your personal data which is no longer necessary for the purpose for which it was processed.

3.           Right to Withdraw Consent: Where the processing of Your personal data is based on Your consent, You have the right to withdraw Your consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. The consequences of such withdrawal will be borne by You.

4.           Right to Grievance Redressal: You have the right to lodge a complaint with Our grievance officer regarding any perceived breach of Your rights or Our obligations under applicable law.

5.           Right to Nominate: You have the right to nominate any other individual who, in the event of Your death or incapacity, shall exercise Your rights under the law.

Children's Privacy

Our services are not intended for individuals under the age of 18. Where personal data relates to an individual under 18 years of age, We will implement appropriate measures to verify age and obtain consent from a parent or lawful guardian before processing such personal data. If We determine that the required consent has not been obtained, We may suspend or discontinue the services.

Changes To This Privacy Policy

We have the discretion to update this Privacy Policy at any time. When We do, We will post a notification on the main page of Our Site and revise the updated date at the bottom of this page. [HSL2] We encourage Users to frequently check this page for any changes to stay informed about how We are helping to protect the personal information We collect. You acknowledge and agree that it is Your responsibility to review this Privacy Policy periodically and become aware of modifications.

Contact

If You have any questions about this Privacy Policy, the practices of this Site, or Your dealings with this Site, or if You wish to exercise Your rights as a User or raise a grievance, please contact Our designated grievance officer at:

The grievance officer name:

Registered Address:

Email: care@thymeindia.com

Phone Number:

 

 

Internal Note to Client: Pursuant to Rule 8(2)-(4) of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, the Company is to implement and maintain IS/ISO/IEC 27001 or an equivalent Government-approved information security standard.[HSL3] 

The exact provision has been pasted as a comment for reference.

 [HSL1]Client to update as per the objects of the MOA.

 [HSL2]To confirm or update per practice.

 [HSL3]8. Reasonable Security Practices and Procedures.— (1) A body corporate or a person on its behalf shall be considered to have complied with reasonable security practices and procedures, if they have implemented such security practices and standards and have a comprehensive documented information security programme and information security policies that contain managerial, technical, operational and physical security control measures that are commensurate with the information assets being protected with the nature of business. In the event of an information security breach, the body corporate or a person on its behalf shall be required to demonstrate, as and when called upon to do so by the agency mandated under the law, that they have implemented security control measures as per their documented information security programme and information security policies.

 

(2) The international Standard IS/ISO/IEC 27001 on "Information Technology - Security Techniques - Information Security Management System - Requirements" is one such standard referred to in sub-rule (1).

 

(3) Any industry association or an entity formed by such an association, whose members are self-regulating by following other than IS/ISO/IEC codes of best practices for data protection as per sub-rule(1), shall get its codes of best practices duly approved and notified by the Central Government for effective implementation.

 

(4) The body corporate or a person on its behalf who have implemented either IS/ISO/IEC 27001 standard or the codes of best practices for data protection as approved and notified under sub-rule (3) shall be deemed to have complied with reasonable security practices and procedures provided that such standard or the codes of best practices have been certified or audited on a regular basis by entities through independent auditor, duly approved by the Central Government. The audit of reasonable security practices and procedures shall be carried cut by an auditor at least once a year or as and when the body corporate or a person on its behalf undertake significant upgradation of its process and computer resource.